File and Hash Threat Intel Writeup

Overview

This room explores enriching file and hash artefacts using threat intelligence, covering malware analysis, hash identification, and behavioral analysis through various security platforms.

Task 1: File Properties Analysis

One file displays one of the indicators mentioned. Can you identify the file and the indicator? (Answer: file, property)

Task 2: Hash and Threat Intelligence Analysis

2.1 What is the SHA256 hash of the file bl0gger?

2.2 On VirusTotal, what is the threat label used to identify the malicious file?

2.3 When was the file first submitted for analysis? (Answer format: YYYY-MM-DD HH:MM:SS)

2.4 According to MalwareBazaar, which vendor classified the Morse-Code-Analyzer file as non-malicious?

2.5 On VirusTotal, what MITRE technique has been flagged for persistence and privilege escalation for the Morse-Code-Analyzer file?

Task 3: Hybrid Analysis Investigation

3.1 What tags are used to identify the bl0gger.exe malicious file on Hybrid Analysis? (Answer: Tag1, Tag2, Tag3)

3.2 What was the stealth command line executed from the file?

3.3 Which other process was spawned according to the process tree?

3.4 The payroll.pdf application seems to be masquerading as which known Windows file?

3.5 What associated URL is linked to the file?

3.6 How many extracted strings were identified from the sandbox analysis of the file?

Task 4: Ransomware Sample Analysis

4.1 What is the SHA256 hash of the file?

4.2 What family labels are assigned to the file on VirusTotal?

4.3 How many security vendors have flagged the file as malicious?

4.4 Name the text file dropped during the execution of the malicious file.

4.5 What PowerShell script is observed to be executed?

4.6 What is the MITRE ATT&CK ID associated with this execution?

Lessons Learned

• Double extensions are a common indicator of malicious files trying to appear legitimate
• SHA256 hashes are crucial for identifying and tracking malware samples across platforms
• VirusTotal aggregates threat intelligence from multiple security vendors
• Not all vendors will classify files the same way - some may mark as clean while others detect malware
• MITRE ATT&CK framework provides standardized techniques for malware behavior
• Hybrid Analysis offers detailed sandbox execution traces and behavior analysis
• Malware often uses living-off-the-land techniques to blend with legitimate processes
• Process trees reveal parent-child relationships and spawned malicious processes
• File masquerading attempts to hide malware behind legitimate Windows executable names
• Malware often connects to command and control servers via suspicious URLs
• String extraction from binaries can reveal configuration data and C2 addresses
• Ransomware families like Akira often have distinctive file markers (readme files, family names)
• Shadow copy deletion is a common anti-forensic technique used by ransomware
• MITRE ATT&CK technique T1490 specifically refers to deleting shadow copies for recovery prevention